Language Model Security Database

Multiple open-weight Large Language Models (LLMs)—specifically those prioritizing capability over safety alignment—exhibit a critical vulnerability to adaptive multi-turn prompt injection and jailbreak attacks. While these models effectively reject isolated, single-turn adversarial inputs (averaging ~13.11% Attack Success Rate), they fail to maintain safety guardrails and policy enforcement across extended conversational contexts. By leveraging iterative strategies such as "Crescendo" (gradual…

Large Language Models (LLMs) are vulnerable to an automated, self-evolving jailbreak attack framework known as ASTRA (Automated Strategy Discovery, Retrieval, and Evolution). This vulnerability exists because current safety alignment mechanisms (such as RLHF) fail to generalize defenses against dynamically distilled and retrieved attack strategies. ASTRA operates on a closed-loop "attack-evaluate-distill-reuse" mechanism. An attacker LLM generates prompts; a separate strategy extractor…

A vulnerability in Large Language Models (LLMs) allows for systematic jailbreaking through a meta-optimization framework called AMIS (Align to MISalign). The attack uses a bi-level optimization process to co-evolve both the jailbreak prompts and the scoring templates used to evaluate them.

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

Large Language Models (LLMs) exhibit a vulnerability to "adversarial conversational nudges," where the model abandons its internal factual knowledge to align with user-provided misinformation in closed domains (e.g., movies, books). Unlike standard hallucinations where a model lacks knowledge, this vulnerability occurs even when the model demonstrates—via separate self-consistency checks—that it correctly identifies the information as false. When a user creates a multi-turn context asserting…

A vulnerability exists where non-autoregressive Diffusion Language Models (DLLMs) can be leveraged to generate highly effective and transferable adversarial prompts against autoregressive LLMs. The technique, named INPAINTING, reframes the resource-intensive search for adversarial prompts into an efficient, amortized inference task. By providing a desired harmful or restricted response to a DLLM, the model can conditionally generate a corresponding low-perplexity prompt that elicits that…

Large Language Models (LLMs), specifically GPT-3.5-turbo, LLaMA3-8B-instruct, and DeepSeek-R1-Distill-Qwen-7B, are vulnerable to a "Self-Harm" jailbreak attack (Self-HarmLLM). This vulnerability exploits the model's ability to understand its own safety boundaries to generate adversarial inputs against itself. An attacker utilizes a two-session approach: in the first session (Mitigation Session), the attacker instructs the model to rewrite a harmful query into a "Mitigated Harmful Query"…

Mobile LLM-based agents (including Mobile-Agent-E, AppAgent, AutoDroid, and others) are vulnerable to indirect prompt injection attacks delivered via untrusted third-party mobile channels, such as in-app advertisements, system notifications, and embedded webviews. These agents utilize Multimodal Large Language Models (MLLMs) to perceive the device state via screenshots or accessibility trees. The vulnerability exists because the agents concatenate the user's prompt ($p$) with the environmental…

Reasoning segmentation models, which generate binary segmentation masks based on implicit text queries, are vulnerable to adversarial paraphrasing. This vulnerability allows an attacker to craft semantically equivalent and grammatically correct text prompts that significantly degrade the model's segmentation performance (measured by Intersection-over-Union, or IoU). The exploit utilizes a black-box, sentence-level optimization method (SPARTA) that operates within the continuous semantic latent…

LLM-based coding agents integrated into IDEs (e.g., VS Code Copilot, Cursor, Windsurf) are vulnerable to a query-agnostic Indirect Prompt Injection (IPI) attack termed "QueryIPI." This vulnerability allows an attacker to achieve Remote Code Execution (RCE) on the developer's machine by injecting a malicious tool definition (e.g., via the Model Context Protocol) into the agent's context.